An agreed-upon procedures engagement is an attestation engagement in which a practitioner performs specific procedures on subject matter and reports the findings without providing an opinion or conclusion, and the subject matter may be financial or nonfinancial information (AICPA, AT-C section 215, paragraph .02). Because the needs of an engaging party may vary widely, the nature, timing, and extent of the procedures may vary as well. The report says what was done and what was found, and stops there.
The Standard That Governs It
The current section is AT-C section 215, sourced to SSAE No. 19, which supersedes SSAE No. 18 section 215 and is effective for agreed-upon procedures reports dated on or after July 15, 2021, with early implementation permitted (AICPA, AT-C section 215). It supplements the requirements common to every attestation engagement, which sit in section 105 and are outlined in risk advisory services.
One carve-out is worth knowing before a firm quotes this work. The section does not apply to engagements to issue letters, commonly referred to as comfort letters, to underwriters and certain other requesting parties (AICPA, AT-C section 215, paragraph .06). Those are a different standard.
Who Agrees, and What They Are Agreeing To
The engagement is named for an agreement, and the standard is specific about whose. Because the engaging party best understands its own needs, the engaging party is required to agree to the procedures and acknowledge that the procedures performed are appropriate for the intended purpose of the engagement prior to issuance of the practitioner’s agreed-upon procedures report (AICPA, AT-C section 215, paragraph .03). Engagement circumstances may be such that it is appropriate for parties in addition to the engaging party to agree to the procedures and acknowledge that the procedures performed are appropriate for their purposes, which is a different test from the intended purpose of the engagement.
That acknowledgment is not a formality, and it has a hard consequence. The practitioner should obtain the written agreement and acknowledgment before issuing the report, and if the engaging party refuses to provide it, the practitioner should withdraw from the engagement (AICPA, AT-C section 215, paragraphs .22 and .23).
Four further preconditions have to be present before the work starts, in addition to the preconditions section 105 already imposes. The practitioner determines that procedures can be designed, performed and reported on under the section, the engaging party agrees or will be able to agree to the procedures and acknowledges that they are appropriate for the intended purpose, the procedures are expected to result in reasonably consistent findings, and where applicable the practitioner agrees to apply a threshold for reporting exceptions established by the engaging party (AICPA, AT-C section 215, paragraph .11).
The Words the Report Cannot Use
The prohibition on vague language is a requirement, not style advice, and it runs in both directions.
On the procedures, the practitioner should not perform procedures that are open to varying interpretations or that use vague or ambiguous language, and terms of uncertain meaning such as general review, limited review, check or test should not be used in describing the procedures unless such terms are defined within the procedures (AICPA, AT-C section 215, paragraph .17).
On the findings, when reporting them the practitioner should not use vague or ambiguous language, should not include terms of uncertain meaning, and should not express an opinion or conclusion on the subject matter or about whether the subject matter is in accordance with (or based on) the criteria (AICPA, AT-C section 215, paragraph .26).
All findings get reported. Where the engaging party has established a threshold for reporting exceptions, the practitioner should describe that threshold in the report (AICPA, AT-C section 215, paragraph .25).
Who Can Perform the Procedures
The procedures enumerated or referred to in the report should be performed by the engagement team or other practitioners and not by internal auditors (AICPA, AT-C section 215, paragraph .21). Where an external specialist assists, the practitioner and the engaging party should explicitly agree to that involvement, and the report should describe the nature of the assistance provided (AICPA, AT-C section 215, paragraphs .19 and .20).
Independence is required, with one narrow exception. Where the practitioner is not independent but is required by law or regulation to accept the engagement and report, the report should specifically state that the practitioner is not independent, and the practitioner is neither required to provide nor precluded from providing the reasons, though a practitioner who gives one reason should give all of them (AICPA, AT-C section 215, paragraph .10).
Restricted Use Is a Judgment, Not a Rule
This is where the AICPA standard and the PCAOB standard part company, and reading across from one to the other is how a firm gets the report wrong.
Under AT-C section 215 the practitioner should consider whether to include an alert, in a separate paragraph, that restricts the use of the report, taking into account the understanding reached with the engaging party about the nature of the engagement (AICPA, AT-C section 215, paragraph .35). Where the alert is included it should state that the report is intended solely for the information and use of the specified parties, identify them, and state that the report is not intended to be and should not be used by anyone else (AICPA, AT-C section 215, paragraph .36).
The PCAOB’s interim attestation standard runs the other way. There, as a consequence of the role of the specified parties in agreeing upon the procedures performed or to be performed, a practitioner’s report on such engagements should clearly indicate that its use is restricted to those specified parties (PCAOB, AT Section 201, paragraph .04). The same standard puts the responsibility for the sufficiency of the procedures on the specified parties, since they best understand their own needs (PCAOB, AT Section 201, paragraph .03).
So the older specified-parties model is still live for engagements performed under PCAOB standards, while the AICPA section moved the agreement and the acknowledgment onto the engaging party and made the use restriction a matter of judgment.
What Goes in the Report
The report should be in writing and in the form of procedures and findings (AICPA, AT-C section 215, paragraphs .31 and .32). Its required contents run to more than twenty items, and four of them are the ones that keep a reader from mistaking it for something else (AICPA, AT-C section 215, paragraph .34).
- A statement that the report may not be suitable for any other purpose.
- A statement that the procedures performed may not address all the items of interest to a user of the report and may not meet the needs of all users of the report, so users are responsible for determining whether the procedures performed are appropriate for their purposes.
- A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or conclusion respectively, on the subject matter, and a statement that the practitioner does not express such an opinion or conclusion.
- A statement that had the practitioner performed additional procedures, other matters might have come to the practitioner’s attention that would have been reported.
The title has to include the word independent, and the report carries the manual or printed signature of the practitioner’s firm, the city and state where it is issued, and a date no earlier than the date on which the practitioner completed the procedures and determined the findings, including that the attestation documentation has been reviewed and, if applicable, the written presentation of the subject matter has been prepared.
What It Is Not
- An examination or a review. In an engagement performed under this section the practitioner does not perform an examination or a review engagement and does not provide an opinion or conclusion, and the report is in the form of procedures and findings instead. The three levels of attestation service and what each report is permitted to say are set out in risk advisory services.
- A comfort letter. Excluded from the section by its own scope paragraph.
- Internal audit work. The standard puts the enumerated procedures outside internal audit’s hands.
Common Questions
No. The practitioner does not perform an examination or a review engagement and does not provide an opinion or conclusion, and the report is in the form of procedures and findings instead (AICPA, AT-C section 215, paragraph .04).
The output. The report itself has to carry a statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or conclusion respectively, on the subject matter, and a statement that the practitioner does not express such an opinion or conclusion (AICPA, AT-C section 215, paragraph .34). It also has to say that had the practitioner performed additional procedures, other matters might have come to the practitioner’s attention that would have been reported. A reader gets the named procedures and their findings, and is told in the report that nothing beyond them was examined.
Yes, other than in the narrow case where law or regulation requires the practitioner to accept the engagement anyway. In that case the lack of independence has to be stated in the report itself.
The engaging party, and it has to say so in writing before the report is issued. If it will not, the standard requires the practitioner to withdraw.
Where the practitioner determines in professional judgment that the description of the procedures performed or the corresponding findings are misleading in the circumstances of the engagement, the practitioner should discuss the matter with the engaging party and take appropriate action (AICPA, AT-C section 215, paragraph .33).
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can grade a real block of that work on its own files through a trial task before any client file moves.
